Bill Gardner

Associate Professor, Cyber Forensics and Security, NSA CAE Point of Contact

[CBS Sports Golazo ⚽️ @CBSSportsGolazo]

FOURTH-TIER FLEETWOOD TOWN ELIMINATE 2025-2026 PREMIER LEAGUE CHAMPIONS ARSENAL FROM THE CARABAO CUP 😱😱😱

BIGGEST UPSET IN ENGLISH FOOTBALL HISTORY 😤

[Matt Johansen @mattjay]

Hackers absolutely compromised New Mexico hospital system.

Surgeries cancelled. Ambulances diverted.

Hackers demands broadcast over the sound system.

[Barstool Sports @barstoolsports]

Arsenal just lost to Fleetwood Town in the EFL Cup.

Arsenal’s roster: $1.5 BILLION
Fleetwood Town’s roster: $3 million

Fleetwood is currently 18th in the 4th level of English soccer.

Possibly the biggest upset in English soccer history.

[Andrew Thompson @ImposeCost]

AI has really reduced the friction for novices to create a lot more work for experts. This php2shell event is just a widescale example of it.

[SecureWV @SecureWVCon]

The SecureWV 17 CTF results are in! 🏆

🥇 CN Solo
🥈 Transportation Gurus
🥉 PHP 5.2.4 is secure right

Congrats to our winners, and thanks to every team that took on Directive Zero. #SecureWV #CTF #InfoSec

[OpenAI @OpenAI]

During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy.

The flaw could let an attacker run their own code on affected systems by sending or replying with malicious compressed data, without any need to create a user account. That is, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl --compressed”) could be taken over by a malicious server.

This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli. Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software. We disclosed the vulnerability to Brotli and other downstream projects such as Node.js, which released or are currently releasing security updates, and Brotli cut new release versions and published a CVE.

More details on the patch and mitigations below:
https://t.co/Y1Y72aHxrW

[SecureWV @SecureWVCon]

Need CPE credits for SecureWV 17? We'll be posting the link to request them soon. Keep an eye on our socials and https://t.co/xUcxUV2fb0. #SecureWV #InfoSec #CPE

[Jesuit News @jesuitnews]

Happy birthday to St. Ignatius of Loyola, founder of the Society of Jesus, who was born on this day in 1491!*

Learn more about his life: https://t.co/nHGuwJT4As

*While we don't know for sure what day he was born, he was born in 1491, and some sources place it on Oct. 23.

[NSA Cyber @NSACyber]

Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.

[Rich Raho @RichRaho]

Pope Leo: “We live in a performance-driven culture that constantly compares and ranks people, sometimes ruthlessly” and a “misguided understanding of meritocracy ultimately fails to respect people.” https://t.co/jkPXLhkmoO

[Marshall University Men's Soccer @HerdMSoccer]

HUGE THREE POINTS 😤

#WeAreMarshall

[SecureWV @SecureWVCon]

Know before you go: SecureWV 17 is at 200 Civic Center Drive, Charleston. Park in the venue garage off Quarrier St ($5 a day), enter the main lobby, and head up to the 2nd floor. Check-in is on the right. #SecureWV #InfoSec

[SecureWV @SecureWVCon]

Bringing your team to SecureWV 17? Two days of talks and workshops in Charleston costs less than most single training courses. $85 a ticket: https://t.co/KAt0I70cY5 #SecureWV #InfoSec #Cybersecurity

[James Martin, SJ @JamesMartinSJ]

Finding God in the gap between what we are called to do and what we are able to do. Listen to my whole conversation with Episcopal Bishop Mariann Budde on the "The Spiritual Life" on @YouTube.
Also on @Apple and @Spotify:
https://t.co/xA46UIZdYL

[SecureWV @SecureWVCon]

Doing the Wazuh threat hunting lab at SecureWV 17? Install VirtualBox and grab the Wazuh OVA before you arrive (it needs ~50 GB). Lab docs: https://t.co/IRPBi5soqh Times: https://t.co/41HLwJTVTt #Wazuh #SecureWV

[SecureWV @SecureWVCon]

One week. SecureWV 17 is Oct 22–23 at the Charleston Coliseum & Convention Center. Plan your two days at https://t.co/41HLwJTVTt, tickets at https://t.co/KAt0I70cY5 #SecureWV #InfoSec #Cybersecurity

[SecureWV @SecureWVCon]

Joining the SecureWV 17 lineup: Luke Brumfield with "Untrusted Ingestion: Enforcing Cryptographic Provenance Across Code, Models, and Data." Can you prove where your code, models and data came from? Tickets: https://t.co/xUcxUV2fb0 #SecureWV #InfoSec #SupplyChainSecurity

[SecureWV @SecureWVCon]

SecureWV has a Discord server, and it's open to anyone into cybersecurity, ticket or not. Job postings, a CTF channel, conference photos, and a few hundred people who like talking shop. Come on in: https://t.co/wkdgxoGzI4 #SecureWV #Cybersecurity #InfoSec

[Charleston Gazette-Mail @wvgazettemail]

Marshall University’s enrollment grew 1.5% year over year, university leaders reported Wednesday during the Board of Governors’ regularly scheduled meeting in Huntington. The number includes dual enrollment students.
https://t.co/L7WjHNZNdI

[ABC News @ABC]

NEW: Artificial intelligence firm Anthropic said in a new warning that small AI models may be months away from being capable enough to self-replicate on devices such as smart ‌ovens and off-brand Android TV boxes.

Read more: https://t.co/XIRvz6bOCt